A flaw exists in the high scores module of IbProArcade which allows malicious SQL Code to be executed on the database the board & arcade use.

Demo: http://www.ibproarcade.com/index.php...&gameid=104FOO

Fix this vuln by following the following directions...

open your sources/Arcade.php file

Find this code bit:

Code:
       //----------------------------------------
// Show_Stats
//
// This shows the leaderboard
//
//----------------------------------------

function show_stats() {

global $ibforums, $DB, $std;

Directly under that, add..

Code:
if(!is_numeric($ibforums->input['gameid']))
{
$std->Error( array( 'LEVEL' => 1, 'MSG' => 'dont_try_it') );
}

then open up your lang/en/lang_Arcade.php file scroll down to the bottom where you will find

Code:
 );

?>

right above that, add this:

Code:
#security
dont_try_it             => "I don't think so annie."
And you're set.